Skip to content
rachel/git-on-cloudflare
File

Blob: test/admin-disclosure.worker.test.ts

typescript222 lines
1import { beforeAll, describe, expect, it } from "vitest";
2import { env, exports as workerExports } from "cloudflare:workers";
3 
4import { newPrefixedId } from "@/worker/common";
5import { createDb } from "@/worker/db/d1/client";
6import { claimNamespace, insertMembershipIfMissing, insertUserIfNew } from "@/worker/db/d1/dal";
7import { asTypedStorage, type RepoStateSchema } from "@/worker/do/repo/repoState";
8 
9import { ensureD1Migrations } from "./util/d1Setup";
10import { mintSessionCookie, setupRepoForTests } from "./util/repoSeed";
11import { seedPackFirstRepo } from "./util/pack-first";
12import { runDOWithRetry } from "./util/test-helpers";
13 
14beforeAll(async () => {
15  await ensureD1Migrations(env);
16});
17 
18async function makeOutsider(): Promise<string> {
19  const db = createDb(env.DB);
20  const userId = newPrefixedId("user");
21  const namespaceId = newPrefixedId("ns");
22  const slug = `out-${Math.random().toString(36).slice(2, 8)}`;
23  const now = Date.now();
24  await insertUserIfNew(db, { id: userId, tesseraSub: `t-${userId}`, createdAt: now });
25  const claimed = await claimNamespace(db, {
26    id: namespaceId,
27    slug,
28    createdBy: userId,
29    createdAt: now,
30  });
31  if (!claimed) throw new Error("namespace already exists");
32  await insertMembershipIfMissing(db, { namespaceId: claimed.id, userId, createdAt: now });
33  return await mintSessionCookie(env, userId);
34}
35 
36async function setupPublicRepoWithReceiveActivity(owner: string, repo: string) {
37  const seededRepo = await setupRepoForTests(env, owner, repo, { visibility: "public" });
38  const seededPack = await seedPackFirstRepo(`${owner}/${repo}`);
39  await runDOWithRetry(seededPack.getStub, async (_instance, state) => {
40    const store = asTypedStorage<RepoStateSchema>(state.storage);
41    const now = Date.now();
42    await store.put("receiveLease", {
43      token: `test-receive-lease-${owner}-${repo}`,
44      createdAt: now,
45      expiresAt: now + 60_000,
46    });
47  });
48  return seededRepo;
49}
50 
51describe("repo page route-cache disclosure", () => {
52  it("anonymous + public repo + missing route cache -> 404", async () => {
53    const owner = `dis-route-${Math.random().toString(36).slice(2, 8)}`;
54    const repo = "site";
55    await setupRepoForTests(env, owner, repo, {
56      visibility: "public",
57      skipRouteCache: true,
58    });
59    const res = await workerExports.default.fetch(`https://example.com/${owner}/${repo}`, {
60      redirect: "manual",
61    });
62    expect(res.status).toBe(404);
63  });
64 
65  it("anonymous + public repo + active receive lease -> hides activity banner", async () => {
66    const owner = `dis-act-anon-${Math.random().toString(36).slice(2, 8)}`;
67    const repo = "site";
68    await setupPublicRepoWithReceiveActivity(owner, repo);
69    const res = await workerExports.default.fetch(`https://example.com/${owner}/${repo}`, {
70      redirect: "manual",
71    });
72    expect(res.status).toBe(200);
73    const html = await res.text();
74    expect(html).not.toContain("Receiving push...");
75  });
76 
77  it("signed-in non-member + public repo + active receive lease -> hides activity banner", async () => {
78    const owner = `dis-act-out-${Math.random().toString(36).slice(2, 8)}`;
79    const repo = "site";
80    await setupPublicRepoWithReceiveActivity(owner, repo);
81    const outsider = await makeOutsider();
82    const res = await workerExports.default.fetch(`https://example.com/${owner}/${repo}`, {
83      headers: { Cookie: outsider },
84      redirect: "manual",
85    });
86    expect(res.status).toBe(200);
87    const html = await res.text();
88    expect(html).not.toContain("Receiving push...");
89  });
90 
91  it("namespace member + public repo + active receive lease -> shows activity banner", async () => {
92    const owner = `dis-act-mem-${Math.random().toString(36).slice(2, 8)}`;
93    const repo = "site";
94    const seeded = await setupPublicRepoWithReceiveActivity(owner, repo);
95    const res = await workerExports.default.fetch(`https://example.com/${owner}/${repo}`, {
96      headers: { Cookie: seeded.cookieHeader },
97      redirect: "manual",
98    });
99    expect(res.status).toBe(200);
100    const html = await res.text();
101    expect(html).toContain("Receiving push...");
102  });
103});
104 
105describe("admin UI page disclosure", () => {
106  it("anonymous + private repo -> 404 (does not redirect to /auth)", async () => {
107    const owner = `dis-${Math.random().toString(36).slice(2, 8)}`;
108    const repo = "site";
109    await setupRepoForTests(env, owner, repo, { visibility: "private" });
110    const res = await workerExports.default.fetch(`https://example.com/${owner}/${repo}/admin`, {
111      redirect: "manual",
112    });
113    expect(res.status).toBe(404);
114  });
115 
116  it("anonymous + public repo -> 302 to /auth?next=...", async () => {
117    const owner = `dis-${Math.random().toString(36).slice(2, 8)}`;
118    const repo = "site";
119    await setupRepoForTests(env, owner, repo, { visibility: "public" });
120    const res = await workerExports.default.fetch(`https://example.com/${owner}/${repo}/admin`, {
121      redirect: "manual",
122    });
123    expect(res.status).toBe(302);
124    expect(res.headers.get("Location") ?? "").toContain("/auth?next=");
125  });
126 
127  it("signed-in non-member + private repo -> 404", async () => {
128    const owner = `dis-${Math.random().toString(36).slice(2, 8)}`;
129    const repo = "site";
130    await setupRepoForTests(env, owner, repo, { visibility: "private" });
131    const outsider = await makeOutsider();
132    const res = await workerExports.default.fetch(`https://example.com/${owner}/${repo}/admin`, {
133      headers: { Cookie: outsider },
134      redirect: "manual",
135    });
136    expect(res.status).toBe(404);
137  });
138 
139  it("signed-in non-member + public repo -> 403", async () => {
140    const owner = `dis-${Math.random().toString(36).slice(2, 8)}`;
141    const repo = "site";
142    await setupRepoForTests(env, owner, repo, { visibility: "public" });
143    const outsider = await makeOutsider();
144    const res = await workerExports.default.fetch(`https://example.com/${owner}/${repo}/admin`, {
145      headers: { Cookie: outsider },
146      redirect: "manual",
147    });
148    expect(res.status).toBe(403);
149  });
150 
151  it("member + private repo -> 200", async () => {
152    const owner = `dis-${Math.random().toString(36).slice(2, 8)}`;
153    const repo = "site";
154    const seeded = await setupRepoForTests(env, owner, repo, { visibility: "private" });
155    const res = await workerExports.default.fetch(`https://example.com/${owner}/${repo}/admin`, {
156      headers: { Cookie: seeded.cookieHeader },
157      redirect: "manual",
158    });
159    expect(res.status).toBe(200);
160  });
161 
162  it("member + private repo + missing route cache -> 200", async () => {
163    const owner = `dis-${Math.random().toString(36).slice(2, 8)}`;
164    const repo = "site";
165    const seeded = await setupRepoForTests(env, owner, repo, {
166      visibility: "private",
167      skipRouteCache: true,
168    });
169    const res = await workerExports.default.fetch(`https://example.com/${owner}/${repo}/admin`, {
170      headers: { Cookie: seeded.cookieHeader },
171      redirect: "manual",
172    });
173    expect(res.status).toBe(200);
174  });
175});
176 
177describe("admin JSON endpoints disclosure (GET admin/refs as a representative)", () => {
178  it("anonymous + private -> 404", async () => {
179    const owner = `disj-${Math.random().toString(36).slice(2, 8)}`;
180    const repo = "site";
181    await setupRepoForTests(env, owner, repo, { visibility: "private" });
182    const res = await workerExports.default.fetch(
183      `https://example.com/${owner}/${repo}/admin/refs`
184    );
185    expect(res.status).toBe(404);
186  });
187 
188  it("anonymous + public -> 401", async () => {
189    const owner = `disj-${Math.random().toString(36).slice(2, 8)}`;
190    const repo = "site";
191    await setupRepoForTests(env, owner, repo, { visibility: "public" });
192    const res = await workerExports.default.fetch(
193      `https://example.com/${owner}/${repo}/admin/refs`
194    );
195    expect(res.status).toBe(401);
196  });
197 
198  it("signed-in non-member + private -> 404", async () => {
199    const owner = `disj-${Math.random().toString(36).slice(2, 8)}`;
200    const repo = "site";
201    await setupRepoForTests(env, owner, repo, { visibility: "private" });
202    const outsider = await makeOutsider();
203    const res = await workerExports.default.fetch(
204      `https://example.com/${owner}/${repo}/admin/refs`,
205      { headers: { Cookie: outsider } }
206    );
207    expect(res.status).toBe(404);
208  });
209 
210  it("signed-in non-member + public -> 403", async () => {
211    const owner = `disj-${Math.random().toString(36).slice(2, 8)}`;
212    const repo = "site";
213    await setupRepoForTests(env, owner, repo, { visibility: "public" });
214    const outsider = await makeOutsider();
215    const res = await workerExports.default.fetch(
216      `https://example.com/${owner}/${repo}/admin/refs`,
217      { headers: { Cookie: outsider } }
218    );
219    expect(res.status).toBe(403);
220  });
221});